Issue Management

An issue is an event or condition with negative effect that has occurred (such as a realized risk) or is certain to occur.

Risk and issue management are closely related and use similar processes. All defense programs encounter risks and issues and must anticipate and address them on a continuing basis.

Through issue management, the program identifies and addresses events or conditions that have already occurred or are certain to occur in the future and have a potential negative impact on the program. 

The program should evaluate the options for correction in terms of cost, schedule, performance, and residual risk, and select the best option (or hybrid of options) consistent with program circumstances. The primary options for issues are:

• Ignore: Accept the consequences without further action based on results of a cost/schedule/performance business case analysis; or
• Control:  Implement a plan to reduce issue consequences and residual risk to as low a level as practical or minimize impact on the program. This option typically applies to high and moderate consequence issues. If an issue arose from a previously recognized risk, some steps to reduce consequences may, or should have already been taken and a plan should be in place before the issue occurs. This is particularly the expectation for an antecedent risk with a high probability of occurrence and is consistent with the recognized continuum of risk to issue as probability increases. 

Less common options include Avoid and Transfer, which carry the same definitions for issues as they do for risks. Avoid is sometimes considered one version of Control and subsumed in that option. 

Issues may occur when a previously identified risk is realized, or issues may emerge without prior recognition of an antecedent risk. In either case, the consequence of an issue needs to be addressed to avoid impeding program progress. As identified risks increase in probability, programs should anticipate their realization as issues and develop early plans to limit the consequences. If an issue emerges from a previously unrecognized risk, the program needs to quickly determine the consequences and timing for resolution to enable the development of plans. Programs also should assess whether issues may create additional potential risks, and should evaluate them accordingly. 

Issue management is complementary to the risk management process. Programs should take advantage of the common practices between issue and risk management while recognizing the distinctive characteristics of each. Programs may evaluate whether a separate issue-specific board is necessary or may be able to operate as efficiently with the RMB. The key is to focus on both issues and risks so the attention on current problems will not overtake efforts to manage risks (and opportunities). Programs should establish an issue management process to ensure issues are identified, analyzed, addressed, and tracked to retirement. The process should enable the program to develop an effective approach for resolving any critical or high-priority issues, to vet the approach at the program management level or above as appropriate, and ensure resources are made available for execution.

Programs should determine the urgency of the issue in order to prioritize its resolution, and should document corrective action plans (sometimes referred to as plans of action and milestones (POA&M)), and include an Estimate at Completion (EAC) and the IMS. The program should update identified issues periodically and review them during regularly scheduled program meetings, program reviews, and technical reviews until the issues are resolved. The program leadership (RMB or equivalent) should assign an owner for each approved issue. Programs may consider combining the risk, issue, and opportunity registers into a single register for ease of management, and should record each approved issue in a register.

Issues should be analyzed using the program’s risk management consequence criteria, and the results entered into the register. Unlike opportunities and risks, no evaluation of issue likelihood is necessary as the probability = 1. Using the top row from the risk matrix, the issue consequence value is converted to an issue level using an issue reporting matrix, and the results are entered into the program’s register. The green, yellow, and red regions on the matrix indicate areas of low, moderate, and high issue level, respectively. 

The program identifies an implementation approach, along with the necessary resources for implementation, obtains approval by the program leadership (RMB or equivalent), and documents the approach in the register. As with risks and opportunities, corrective activities for issues should be included in the IMS.  

The program should track resolution of issues against the corrective action plan. Once the plan is in place, the program office should (1) monitor the issue to collect actual versus planned cost, schedule, and performance information; (2) feed this information back to the previous process steps; (3) adjust the plan as warranted; and (4) analyze potential changes in the issue, its level, and potential associated risks. This information should be included in the program’s risk/issue register.